Many IKE implementations support manually configuring trusted public keys, without having to create a CA, generate CSRs, sign certificates, or remember/look up the commands to do those things.
Keep in mind that certificates are just public keys wrapped with some extra metadata so that your router can automatically verify that it belongs to someone you trust. Certificates are useful for instances where there are so many peers that it's infeasible to manually configure each one's public key, such as a "road warrior" configuration or DMVPN. In those scenarios it makes sense to set up a Certificate Authority to handle it.
Different implementations use different formats to represent public keys, and it's necessary to be able to convert between them. Here is a script for that purpose:
|strongSwan >= 5.0.0||PEM|
|Cisco IOS||Hexadecimal DER|
|Racoon||Base64 RFC 3110|
|strongSwan < 5.0.0||Base64 RFC 3110|
|VyOS/EdgeOS||Base64 RFC 3110|
Last edited by lare, 2023-04-08 21:53:12